Why suricata don't generate filehash for alerts

Ideally post both logs, the full suricata log but also the one from zeek.
Hard to compare/debug without more details.